CVE-2026-42304: Twisted Denial of Service via DNS compression pointer chains

CVE-2026-42304 · Severity: high · CVSS 7.5 · Published 2026-05-13

Twisted, a popular Python networking engine, contains a flaw in its DNS handling module. An attacker can send a specially crafted DNS request that causes the server to become unresponsive while trying to process complex data structures. This results in a denial-of-service, preventing the server from handling any other legitimate network traffic or requests.

Technologies: twisted (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-42304 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42304 being exploited in the wild.
How severe is CVE-2026-42304?
High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?
twisted (PyPI) ECOSYSTEM:introduced=0,fixed=26.4.0, ECOSYSTEM:introduced=0,fixed=26.4.0rc2; Twisted Matrix Laboratories Twisted <= 25.5.0.
Is there a fix for CVE-2026-42304?
Yes. twisted (PyPI): upgrade to 26.4.0, 26.4.0rc2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42304 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42304?
Check whether you run twisted (PyPI) or Twisted Matrix Laboratories Twisted at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • twisted (PyPI): upgrade to 26.4.0, 26.4.0rc2 or later
    pip install "twisted>=26.4.0rc2"

Technical details

The vulnerability exists in the twisted.names.dns.Name.decode function due to inefficient algorithmic complexity when handling DNS compression pointers. While the module contains logic to prevent infinite loops, it lacks a limit on the total number of pointer dereferences allowed per message. Additionally, the 'visited' set used for loop detection is reset for each Question record. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet with thousands of questions pointing to a deep chain of compression pointers, causing the single-threaded Twisted reactor to hang during decompression. This issue is addressed in version 26.4.0rc2.

Affected products

  • Twisted Matrix Labs Twisted <= 25.5.0

Identifiers

  • CVE-2026-42304
  • GHSA-grgv-6hw6-v9g4
  • PYSEC-2026-160

Timeline

  • 2026-04-18: disclosed: Initial disclosure date according to researcher profile
  • 2026-04-29: advisory: GitHub Advisory published
  • 2026-05-13: advisory: NVD published CVE-2026-42304

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.